Full Report
Allen-Bradley Stratix 5950 network security appliances are affected by multiple vulnerabilities. The flaws, which are due to security issues in the Cisco ASA operating system used in the devices, could cause the appliances to malfunction
Analysis Summary
# Vulnerability: Multiple Security Flaws in Allen-Bradley Stratix 5950 (Cisco ASA Based)
## CVE Details
*Note: As this advisory relates to the integration of Cisco ASA software into Rockwell hardware, multiple CVEs are involved. The primary critical vulnerabilities include:*
- **CVE ID:** CVE-2018-0101 (Primary Critical)
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
- **CVE ID:** CVE-2018-0231 / CVE-2018-0240
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Allen-Bradley Stratix 5950 Network Security Appliance.
- **Versions:** All versions prior to 5.14.0.
- **Configurations:** Systems utilizing Cisco ASA-based security services, specifically those with WebVPN/AnyConnect SSL VPN enabled (for CVE-2018-0101) or specific SNMP configurations.
## Vulnerability Description
The Stratix 5950 utilizes the Cisco Adaptive Security Appliance (ASA) operating system. The identified flaws are inherited from the underlying Cisco software:
1. **Remote Code Execution (CVE-2018-0101):** A vulnerability in the XML parser of the WebVPN feature allows an unauthenticated, remote attacker to cause a reload of the affected system or remotely execute code. This is caused by an attempt to double-free a region of memory.
2. **Denial of Service:** Several flaws in the handling of SNMP packets and specific SSL/TLS fragments can cause the device to hang or crash, leading to a complete loss of security filtering and connectivity.
## Exploitation
- **Status:** PoC available (Public exploits for CVE-2018-0101 have been documented and released following the Cisco disclosure).
- **Complexity:** Low to Medium (depending on the specific CVE and enabled features).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential for full system takeover).
- **Integrity:** High (Modification of security rules and device configuration).
- **Availability:** High (Device crashes and continuous reboots).
## Remediation
### Patches
Rockwell Automation released updated firmware to address these inherited Cisco vulnerabilities:
- **Upgrade to Stratix 5950 Firmware version 5.14.0 or later.**
- Users are advised to download updates from the Rockwell Automation Product Compatibility and Download Center (PCDC).
### Workarounds
- **Disable SSL VPN:** If WebVPN/AnyConnect services are not required, disabling them mitigates CVE-2018-0101.
- **Access Control Lists (ACLs):** Restrict access to management interfaces (SNMP, HTTPS) to trusted internal hosts only.
- **Disable SNMP:** Disable SNMP services if not actively used for monitoring.
## Detection
- **Indicators of Compromise:** Frequent, unexplained device reboots; inability to access the management web interface; high CPU usage without increased traffic load.
- **Detection Methods:**
- Scan for the presence of the WebVPN service on the appliance.
- Utilize Intrusion Prevention Systems (IPS) signatures that detect "Cisco ASA Directory Traversal" or "Cisco ASA Remote Code Execution" attempts.
## References
- **Rockwell Automation Advisory:** hxxps[://]rockwellautomation[.]custhelp[.]com/app/answers/detail/a_id/1074092
- **Cisco Security Advisory (Base Vulnerability):** hxxps[://]tools[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/publications/vulnerability-announcements/2018/07/09/multiple-vulnerabilities-in-allen-bradley-stratix-5950-appliances/